But right now if I go directly to the ports the apps are running on (localhost:3000) I can access them that way too.

Thats because you are using -p aka --publish command in your docker run

Explanation:

If you want to expose ports between containers only, Do Not use -p or --publish just put them on the same docker network.

Example:

Lets create a new user-defined network:

sudo docker network create appnet

Lets create nginx container for reverse proxy, It should be available to outside world so we use publish.

sudo docker run --name nginx -d --network appnet nginx

Now put your apps in the same network but do not expose ports.

sudo docker run --name app1 -d --network appnet <app image name/id>

You have to use Docker networks.

The default network is shared with host, thus accessible from localhost. You can either configure Docker, creating a network manually, or let tools like docker-compose or Kubernetes to do it for you.